Big problème :s

Gretel · le 19 juin 2009

Bonjour à tous !

Voilà, depuis quelques jours un beau virus vient de se manifester sur le PC. Celui-ci change le fond d'écran du bureau, bloque Antivir et le parefeu Windows, et sollicite l'aide d'un antivirus en anglais complètement bidon qui se lance maintenant au démarrage.

MSN et Orange ne se lancent plus, et diverses fenêtres apparaissent durant la navigation sur le net.

Voici le rapport HiJackThis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:57:45, on 19/06/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Safe mode with network support

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\WgaTray.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Documents and Settings\utilisateur\Bureau\Programmes\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - C:\Program Files\Mario Forever Toolbar\v2.0.0.3\Mario_Forever_Toolbar.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.3\Mario_Forever_Toolbar.dll

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [webrebates] "C:\Program Files\WebRebates4\webrebates.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe

O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [systrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"

O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Fichiers communs\Acronis\Acronis Disk Director\oss_reinstall.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [13672034] C:\Documents and Settings\All Users\Application Data\13672034\13672034.exe

O4 - HKLM\..\Run: [93682026] C:\Documents and Settings\All Users\Application Data\93682026\93682026.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [AdmChk] C:\WINDOWS\system32\tkdsvoho.exe

O4 - HKLM\..\Policies\Explorer\Run: [NX8YA1JRsI] C:\Documents and Settings\All Users\Application Data\bmhmzezw\xovuzkxm.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

O15 - Trusted Zone: http://www.orange.fr

O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clien...1.0/Rawflow.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200411...meInstaller.exe

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab

O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://62.201.137.56/mmawap/jsp/composer/p...r/mmsPlayer.cab

O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B97E849A-D59D-4DF5-92DB-962861B5A071}: NameServer = 80.10.246.2,80.10.246.129

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

O23 - Service: HDD Temperature (HDDTService) - PalickSoft - C:\Program Files\PalickSoft\HDD Temperature\HDDTSvc.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

--

End of file - 7391 bytes

D'avance, merci !

Apollo · le 19 juin 2009

Bonjour,

EDIT: vois le message suivant stp.

++

Modifié le 19 juin 2009 par Apollo

pear · le 19 juin 2009

Bonjour,

Cet outil est conçu pour traiter les infections de type "Lop , Cid, Trojan Swizzor" , il peut indiquer des Fichiers / Dossiers légitimes !

Désactiver les protections résidentes ( Antivirus, etc...), vous les réactiverez ensuite,

Si vous utilisez Spybot

Pour désactiver TeaTimer qui ne set à rien et peut faire échouer une désinfection:!

Afficher d'abord le Mode Avancé dans SpyBot

->Options Avancées :

- >menu Mode, Mode Avancé.

Une colonne de menus apparaît dans la partie gauche :

- >cliquer sur Outils,

- >cliquer sur Résident,

Dans Résident :

- >décocher Résident "TeaTimer" pour le désactiver.

Télécharger Lop S&D de Eric71

sur le bureau,

* Double-cliquer dessus pour lancer l'installation

* Puis double-cliquer sur le raccourci Lop S&D présent sur le bureau

* Séléctionner la langue souhaitée , puis choisir l'Option 1:Recherche

* En cas de blocage au démarrage

Démarrer / Exécuter / cmd

Copiez/collez, dans la fenêtre del /Q "%systemdrive%\Lop SD\osv.exe" & "%systemdrive%\Lop SD\lopsd.cmd"

et valider , il devrait se lancer tout seul ,

* Patienter jusqu'à la fin du scan

* Poster le rapport généré (C:\lopR.txt)

( Si le Bureau ne réapparait pas

presser Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , taper explorer.exe et valider )

Relancer Lop S&D

* Choisir l'Option 2 :Suppression

* Ne fermez pas la fenêtre lors de la suppression !

* Poster le rapport généré (C:\lopR.txt)

(Si le Bureau ne réapparaît pas presser Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , taper explorer.exe et valider)

Téléchargez Malwarebytes' Anti-Malware (MBAM)

[branchez tous les supports amovibles avant de faire ce scan (clé usb/disque dur externe etc)

Si vous utilisez Spybot

Pour désactiver TeaTimer qui ne set à rien et peut faire échouer une désinfection:!

Afficher d'abord le Mode Avancé dans SpyBot

->Options Avancées :

- >menu Mode, Mode Avancé.

Une colonne de menus apparaît dans la partie gauche :

- >cliquer sur Outils,

- >cliquer sur Résident,

Dans Résident :

- >décocher Résident "TeaTimer" pour le désactiver.

* Double cliquez sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation.

Enregistrez le sur le bureau .

Fermer toutes les fenêtres et programmes

Suivez les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet)

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

Vérifiez que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse.

cliquer sur OK pour fermer la boîte de dialogue..

* Dans l'onglet "mise à jour", cliquez sur le bouton Recherche de mise à jour:

Si le pare-feu demande l'autorisation à MBAM de se connecter, acceptez.

* Une fois la mise à jour terminée, allez dans l'onglet Recherche.

* Sélectionnez "Exécuter un examen complet"

* Cliquez sur "Rechercher"

* .L' analyse prendra un certain temps, soyez patient !

* A la fin , un message affichera :

L'examen s'est terminé normalement.

*Si MBAM n'a rien trouvé, il le dira aussi.

Cliquez sur "Ok" pour poursuivre.

*Fermez les navigateurs.

Cliquez sur Afficher les résultats .

*Sélectionnez tout et cliquez sur Supprimer la sélection ,

MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

puis ouvrir le Bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

* Copiez-collez ce rapport dans la prochaine réponse.

Gretel · le 19 juin 2009

Bonjour, et merci beaucoup pour l'aide apportée ^^

Voici les rapports demandés :

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2

X86-based PC ( Uniprocessor Free : AMD Athlon XP 2000+ )

BIOS : Version 1.00

USER : utilisateur ( Administrator )

BOOT : Fail-safe with network boot

Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Not Activated)

C:\ (Local Disk) - NTFS - Total:38 Go (Free:26 Go)

D:\ (CD or DVD)

E:\ (CD or DVD)

F:\ (Local Disk) - NTFS - Total:152 Go (Free:38 Go)

G:\ (USB)

H:\ (USB)

I:\ (USB)

J:\ (USB)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [1] ( 19/06/2009|13:23 )

--------------------\\ Listing des dossiers dans APPLIC~1

[15/06/2009|19:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\13672034

[15/06/2009|15:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\93682026

[14/06/2008|21:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe

[04/12/2005|17:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead

[11/11/2008|05:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira

[28/12/2007|18:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU

[03/06/2009|12:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender

[10/11/2008|03:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\bmhmzezw

[26/10/2007|23:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft

[14/09/2007|14:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[13/01/2007|21:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OrbNetworks

[19/11/2004|19:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[03/06/2006|17:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real

[18/06/2005|19:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G2

[23/12/2004|06:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation

[11/11/2008|22:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[24/03/2007|06:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

[27/09/2006|03:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[01/01/2006|21:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[16/11/2004|17:07] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[16/11/2004|17:15] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[16/11/2004|17:15] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[12/06/2006|10:59] C:\DOCUME~1\UTILIS~1\APPLIC~1\.bittorrent

[14/06/2008|21:01] C:\DOCUME~1\UTILIS~1\APPLIC~1\Adobe

[12/01/2007|05:26] C:\DOCUME~1\UTILIS~1\APPLIC~1\AdobeUM

[04/12/2005|18:21] C:\DOCUME~1\UTILIS~1\APPLIC~1\Ahead

[28/12/2007|18:26] C:\DOCUME~1\UTILIS~1\APPLIC~1\AVS4YOU

[23/05/2009|21:25] C:\DOCUME~1\UTILIS~1\APPLIC~1\Azureus

[23/04/2006|13:38] C:\DOCUME~1\UTILIS~1\APPLIC~1\Cleaner Kit

[06/12/2008|01:21] C:\DOCUME~1\UTILIS~1\APPLIC~1\DMCache

[08/12/2007|06:52] C:\DOCUME~1\UTILIS~1\APPLIC~1\dvdcss

[23/05/2006|20:50] C:\DOCUME~1\UTILIS~1\APPLIC~1\fltk.org

[07/02/2005|18:23] C:\DOCUME~1\UTILIS~1\APPLIC~1\Help

[30/04/2009|23:34] C:\DOCUME~1\UTILIS~1\APPLIC~1\Icone

[16/11/2004|17:16] C:\DOCUME~1\UTILIS~1\APPLIC~1\Identities

[04/10/2008|00:50] C:\DOCUME~1\UTILIS~1\APPLIC~1\IDMComp

[03/10/2008|16:17] C:\DOCUME~1\UTILIS~1\APPLIC~1\ImgBurn

[25/02/2007|14:15] C:\DOCUME~1\UTILIS~1\APPLIC~1\InstallShield

[01/11/2006|21:11] C:\DOCUME~1\UTILIS~1\APPLIC~1\Macromedia

[03/06/2006|17:26] C:\DOCUME~1\UTILIS~1\APPLIC~1\Media Player Classic

[12/06/2009|23:19] C:\DOCUME~1\UTILIS~1\APPLIC~1\Microsoft

[15/07/2008|18:02] C:\DOCUME~1\UTILIS~1\APPLIC~1\Move Networks

[03/06/2006|17:26] C:\DOCUME~1\UTILIS~1\APPLIC~1\Real

[18/06/2005|19:49] C:\DOCUME~1\UTILIS~1\APPLIC~1\River Past G2

[23/12/2004|07:05] C:\DOCUME~1\UTILIS~1\APPLIC~1\Sony Corporation

[08/01/2005|01:38] C:\DOCUME~1\UTILIS~1\APPLIC~1\Sun

[24/03/2007|06:35] C:\DOCUME~1\UTILIS~1\APPLIC~1\Symantec

[01/02/2005|15:47] C:\DOCUME~1\UTILIS~1\APPLIC~1\teamspeak2

[10/03/2007|20:59] C:\DOCUME~1\UTILIS~1\APPLIC~1\U3

[16/10/2005|14:02] C:\DOCUME~1\UTILIS~1\APPLIC~1\vlc

[29/09/2008|02:01] C:\DOCUME~1\UTILIS~1\APPLIC~1\WinRAR

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[18/06/2009 15:04][--ah-----] C:\WINDOWS\tasks\SA.DAT

[07/10/2003 02:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[04/06/2005|21:52] C:\Program Files\_ArcadeDownloadFolder

[01/04/2009|18:38] C:\Program Files\Acronis

[27/05/2005|15:04] C:\Program Files\Adobe

[04/12/2005|18:01] C:\Program Files\Ahead

[19/05/2006|15:54] C:\Program Files\Altiris

[11/11/2008|04:17] C:\Program Files\Alwil Software

[30/04/2009|04:18] C:\Program Files\Audacity

[11/11/2008|05:28] C:\Program Files\Avira

[28/12/2007|19:20] C:\Program Files\AVS4YOU

[05/03/2009|03:05] C:\Program Files\Azureus

[18/02/2009|15:50] C:\Program Files\BitComet

[12/06/2006|10:59] C:\Program Files\BitTorrent

[06/05/2006|23:34] C:\Program Files\Call of Duty Single Player Demo

[31/07/2005|17:07] C:\Program Files\Camouflage

[23/05/2006|16:31] C:\Program Files\Canon

[28/07/2005|21:48] C:\Program Files\CDex_150

[16/11/2004|18:44] C:\Program Files\C-Media 3D Audio

[16/11/2004|17:04] C:\Program Files\ComPlus Applications

[08/11/2006|20:21] C:\Program Files\Datel

[26/11/2004|13:44] C:\Program Files\Disney Interactive

[07/06/2007|03:14] C:\Program Files\DivX

[01/04/2007|06:26] C:\Program Files\DkZ Studio

[01/04/2009|22:11] C:\Program Files\EASEUS

[18/06/2009|20:24] C:\Program Files\eMule

[19/03/2006|01:01] C:\Program Files\ETAJV DS

[23/07/2006|14:53] C:\Program Files\ffdshow

[01/04/2009|18:38] C:\Program Files\Fichiers communs

[05/01/2005|00:04] C:\Program Files\FileZilla

[04/11/2005|22:08] C:\Program Files\FLAC

[11/09/2006|21:19] C:\Program Files\GoldWave

[23/07/2006|14:53] C:\Program Files\Haali

[04/10/2008|00:50] C:\Program Files\IDM Computer Solutions

[28/07/2005|05:07] C:\Program Files\Illustrate

[03/10/2008|15:20] C:\Program Files\ImgBurn

[29/05/2008|18:39] C:\Program Files\InstallShield Installation Information

[04/12/2005|17:25] C:\Program Files\InterActual

[07/11/2006|11:53] C:\Program Files\Internet Download Manager

[30/04/2009|23:34] C:\Program Files\Internet Explorer

[27/03/2009|01:45] C:\Program Files\Java

[13/01/2006|22:46] C:\Program Files\Mario Forever

[13/01/2006|22:47] C:\Program Files\Mario Forever Toolbar

[16/09/2005|19:12] C:\Program Files\MatroskaProp

[29/04/2006|15:18] C:\Program Files\Maxtor

[03/06/2006|17:24] C:\Program Files\Media Player Classic

[25/11/2006|05:36] C:\Program Files\MediaCoder

[20/11/2004|01:57] C:\Program Files\Meridian Advance

[19/10/2008|15:27] C:\Program Files\Messenger

[16/11/2004|17:08] C:\Program Files\microsoft frontpage

[16/11/2004|17:46] C:\Program Files\Microsoft Office

[16/11/2004|17:47] C:\Program Files\Microsoft.NET

[14/06/2008|21:01] C:\Program Files\Mii Editor

[25/10/2007|03:55] C:\Program Files\Motherboard Monitor 5

[15/10/2008|15:14] C:\Program Files\Movie Maker

[16/09/2005|19:29] C:\Program Files\MRT Codecs Pack

[16/11/2004|17:04] C:\Program Files\MSN

[16/11/2004|17:04] C:\Program Files\MSN Gaming Zone

[14/09/2007|14:30] C:\Program Files\MSN Messenger

[08/11/2006|20:22] C:\Program Files\MSXML 4.0

[14/06/2009|16:06] C:\Program Files\MSXML 6.0

[08/10/2008|18:48] C:\Program Files\Navilog1

[24/06/2007|12:29] C:\Program Files\Navman

[15/10/2008|15:14] C:\Program Files\NetMeeting

[02/07/2007|05:02] C:\Program Files\NintendoVIP

[24/03/2007|06:35] C:\Program Files\Norton AntiVirus

[16/09/2005|19:09] C:\Program Files\On2 Technologies

[05/12/2005|03:07] C:\Program Files\ONES Trial (F)

[29/05/2008|18:53] C:\Program Files\Orange

[25/01/2007|05:12] C:\Program Files\Orb Networks

[15/10/2008|15:14] C:\Program Files\Outlook Express

[24/10/2007|14:42] C:\Program Files\PalickSoft

[26/11/2004|14:07] C:\Program Files\PAN vision

[04/07/2007|15:42] C:\Program Files\Pkd-X 2

[27/03/2009|01:52] C:\Program Files\PS3 Media Server

[25/10/2006|02:44] C:\Program Files\QuickSFV

[21/11/2004|14:00] C:\Program Files\QuickTime

[16/10/2006|05:22] C:\Program Files\Qvlyuvx

[08/11/2006|04:12] C:\Program Files\RADVideo

[03/06/2006|17:24] C:\Program Files\Real Alternative

[30/04/2007|19:50] C:\Program Files\Red Kawa

[10/11/2008|19:39] C:\Program Files\RegCleaner

[08/10/2008|20:13] C:\Program Files\RegFreeze

[08/11/2006|03:52] C:\Program Files\RM-X© Wmv To DivX

[14/06/2008|04:51] C:\Program Files\RomStation

[29/05/2008|18:39] C:\Program Files\SAGEM

[04/12/2005|17:10] C:\Program Files\SAMSUNG

[24/03/2007|06:59] C:\Program Files\SearchRelevant

[29/05/2008|18:38] C:\Program Files\Securitoo

[16/11/2004|17:06] C:\Program Files\Services en ligne

[24/11/2008|16:03] C:\Program Files\SHARP

[16/11/2004|18:43] C:\Program Files\SiSLan

[24/01/2005|22:01] C:\Program Files\SLD CODEC PACK 1.5.3

[17/09/2008|20:25] C:\Program Files\Smart Projects

[24/03/2007|06:41] C:\Program Files\Softwin

[23/12/2004|06:51] C:\Program Files\Sony

[02/06/2005|05:32] C:\Program Files\Soulseek

[27/10/2008|02:44] C:\Program Files\SpeedFan

[11/11/2008|21:08] C:\Program Files\Spybot - Search & Destroy

[24/03/2007|06:33] C:\Program Files\Symantec

[18/06/2009|15:04] C:\Program Files\The Cleaner

[05/01/2005|17:47] C:\Program Files\THQ

[24/03/2007|07:01] C:\Program Files\TopSearch

[21/06/2005|18:12] C:\Program Files\TrackManiaDemo

[10/11/2008|19:20] C:\Program Files\trend micro

[24/03/2007|07:01] C:\Program Files\TV Media

[09/06/2005|01:09] C:\Program Files\Ultra Video Splitter

[09/12/2004|12:20] C:\Program Files\Uninstall Information

[01/11/2008|21:57] C:\Program Files\vdicmyc

[16/10/2005|13:51] C:\Program Files\VideoLAN

[29/11/2005|18:50] C:\Program Files\Vivitar

[05/12/2005|03:03] C:\Program Files\VSO

[29/05/2008|18:50] C:\Program Files\Wanadoo

[05/09/2005|15:19] C:\Program Files\Wanadoo Messager

[24/03/2007|07:01] C:\Program Files\WebRebates4

[16/02/2009|18:31] C:\Program Files\Western Digital

[30/09/2005|01:24] C:\Program Files\Winamp

[07/12/2006|18:20] C:\Program Files\Windows Media Connect 2

[15/10/2008|15:14] C:\Program Files\Windows Media Player

[15/10/2008|15:14] C:\Program Files\Windows NT

[15/12/2005|03:38] C:\Program Files\Windows ServeAd

[15/12/2004|11:11] C:\Program Files\WindowsUpdate

[29/09/2008|01:33] C:\Program Files\WinRAR

[16/11/2004|17:08] C:\Program Files\xerox

[06/01/2008|18:27] C:\Program Files\Xilisoft

[16/09/2005|19:29] C:\Program Files\XviD

[01/01/2006|21:04] C:\Program Files\Yahoo!

[21/11/2004|04:46] C:\Program Files\YDKJWIN

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[01/04/2009|18:38] C:\Program Files\Fichiers communs\Acronis

[27/05/2005|15:11] C:\Program Files\Fichiers communs\Adobe

[14/06/2008|20:59] C:\Program Files\Fichiers communs\Adobe AIR

[04/12/2005|17:56] C:\Program Files\Fichiers communs\Ahead

[28/12/2007|19:20] C:\Program Files\Fichiers communs\AVSMedia

[16/11/2004|17:46] C:\Program Files\Fichiers communs\DESIGNER

[29/05/2008|18:49] C:\Program Files\Fichiers communs\France Telecom

[23/12/2004|06:45] C:\Program Files\Fichiers communs\InstallShield

[21/05/2006|18:24] C:\Program Files\Fichiers communs\Java

[28/12/2007|18:24] C:\Program Files\Fichiers communs\Microsoft Shared

[16/11/2004|17:05] C:\Program Files\Fichiers communs\MSSoap

[04/12/2005|17:59] C:\Program Files\Fichiers communs\Nero

[15/07/2006|20:35] C:\Program Files\Fichiers communs\NSV

[18/05/2008|22:42] C:\Program Files\Fichiers communs\Nullsoft

[16/11/2004|16:59] C:\Program Files\Fichiers communs\ODBC

[21/06/2005|18:16] C:\Program Files\Fichiers communs\Real

[16/11/2004|17:05] C:\Program Files\Fichiers communs\Services

[24/03/2007|06:41] C:\Program Files\Fichiers communs\Softwin

[23/12/2004|06:46] C:\Program Files\Fichiers communs\Sony Shared

[16/11/2004|16:59] C:\Program Files\Fichiers communs\SpeechEngines

[24/03/2007|06:35] C:\Program Files\Fichiers communs\Symantec Shared

[15/10/2008|15:14] C:\Program Files\Fichiers communs\System

[29/11/2005|18:50] C:\Program Files\Fichiers communs\ViviCam5DQ

--------------------\\ Process

( 18 Processes )

iexplore.exe ~ [PID:1836]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@adultfriendfinder[1].txt

C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@ero-advertising[1].txt

C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@cotedazurpalace[1].txt

C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@serve.cotedazurpalace[1].txt

C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@adopt.euroclick[1].txt

C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@euroclick[2].txt

C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@partypoker[2].txt

C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@888[2].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-19 13:30:25

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

disk error: C:\WINDOWS\System32\

please note that you need administrator rights to perform deep scan

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:712][D:36]-> C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp

[F:895][D:0]-> C:\DOCUME~1\UTILIS~1\Cookies

[F:4395][D:32]-> C:\DOCUME~1\UTILIS~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 19/06/2009|13:33 - Option : [1]

--------------------\\ Fin du rapport a 13:33:58

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2

X86-based PC ( Uniprocessor Free : AMD Athlon XP 2000+ )

BIOS : Version 1.00

USER : utilisateur ( Administrator )

BOOT : Fail-safe with network boot

Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Not Activated)

C:\ (Local Disk) - NTFS - Total:38 Go (Free:26 Go)

D:\ (CD or DVD)

E:\ (CD or DVD)

F:\ (Local Disk) - NTFS - Total:152 Go (Free:38 Go)

G:\ (USB)

H:\ (USB)

I:\ (USB)

J:\ (USB)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [2] ( 19/06/2009|13:35 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@adultfriendfinder[1].txt

Supprime! - C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@ero-advertising[1].txt

Supprime! - C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@cotedazurpalace[1].txt

Supprime! - C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@serve.cotedazurpalace[1].txt

Supprime! - C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@adopt.euroclick[1].txt

Supprime! - C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@euroclick[2].txt

Supprime! - C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@partypoker[2].txt

Supprime! - C:\DOCUME~1\UTILIS~1\Cookies\utilisateur@888[2].txt

-

[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[15/06/2009|19:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\13672034

[15/06/2009|15:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\93682026

[14/06/2008|21:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe

[04/12/2005|17:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead

[11/11/2008|05:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira

[28/12/2007|18:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU

[03/06/2009|12:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender

[10/11/2008|03:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\bmhmzezw

[26/10/2007|23:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft

[14/09/2007|14:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[13/01/2007|21:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OrbNetworks

[19/11/2004|19:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[03/06/2006|17:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real

[18/06/2005|19:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G2

[23/12/2004|06:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation

[11/11/2008|22:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[24/03/2007|06:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

[27/09/2006|03:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[01/01/2006|21:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[16/11/2004|17:07] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[16/11/2004|17:15] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[16/11/2004|17:15] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[12/06/2006|10:59] C:\DOCUME~1\UTILIS~1\APPLIC~1\.bittorrent

[14/06/2008|21:01] C:\DOCUME~1\UTILIS~1\APPLIC~1\Adobe

[12/01/2007|05:26] C:\DOCUME~1\UTILIS~1\APPLIC~1\AdobeUM

[04/12/2005|18:21] C:\DOCUME~1\UTILIS~1\APPLIC~1\Ahead

[28/12/2007|18:26] C:\DOCUME~1\UTILIS~1\APPLIC~1\AVS4YOU

[23/05/2009|21:25] C:\DOCUME~1\UTILIS~1\APPLIC~1\Azureus

[23/04/2006|13:38] C:\DOCUME~1\UTILIS~1\APPLIC~1\Cleaner Kit

[06/12/2008|01:21] C:\DOCUME~1\UTILIS~1\APPLIC~1\DMCache

[08/12/2007|06:52] C:\DOCUME~1\UTILIS~1\APPLIC~1\dvdcss

[23/05/2006|20:50] C:\DOCUME~1\UTILIS~1\APPLIC~1\fltk.org

[07/02/2005|18:23] C:\DOCUME~1\UTILIS~1\APPLIC~1\Help

[30/04/2009|23:34] C:\DOCUME~1\UTILIS~1\APPLIC~1\Icone

[16/11/2004|17:16] C:\DOCUME~1\UTILIS~1\APPLIC~1\Identities

[04/10/2008|00:50] C:\DOCUME~1\UTILIS~1\APPLIC~1\IDMComp

[03/10/2008|16:17] C:\DOCUME~1\UTILIS~1\APPLIC~1\ImgBurn

[25/02/2007|14:15] C:\DOCUME~1\UTILIS~1\APPLIC~1\InstallShield

[01/11/2006|21:11] C:\DOCUME~1\UTILIS~1\APPLIC~1\Macromedia

[03/06/2006|17:26] C:\DOCUME~1\UTILIS~1\APPLIC~1\Media Player Classic

[12/06/2009|23:19] C:\DOCUME~1\UTILIS~1\APPLIC~1\Microsoft

[15/07/2008|18:02] C:\DOCUME~1\UTILIS~1\APPLIC~1\Move Networks

[03/06/2006|17:26] C:\DOCUME~1\UTILIS~1\APPLIC~1\Real

[18/06/2005|19:49] C:\DOCUME~1\UTILIS~1\APPLIC~1\River Past G2

[23/12/2004|07:05] C:\DOCUME~1\UTILIS~1\APPLIC~1\Sony Corporation

[08/01/2005|01:38] C:\DOCUME~1\UTILIS~1\APPLIC~1\Sun

[24/03/2007|06:35] C:\DOCUME~1\UTILIS~1\APPLIC~1\Symantec

[01/02/2005|15:47] C:\DOCUME~1\UTILIS~1\APPLIC~1\teamspeak2

[10/03/2007|20:59] C:\DOCUME~1\UTILIS~1\APPLIC~1\U3

[16/10/2005|14:02] C:\DOCUME~1\UTILIS~1\APPLIC~1\vlc

[29/09/2008|02:01] C:\DOCUME~1\UTILIS~1\APPLIC~1\WinRAR

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[18/06/2009 15:04][--ah-----] C:\WINDOWS\tasks\SA.DAT

[07/10/2003 02:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[04/06/2005|21:52] C:\Program Files\_ArcadeDownloadFolder

[01/04/2009|18:38] C:\Program Files\Acronis

[27/05/2005|15:04] C:\Program Files\Adobe

[04/12/2005|18:01] C:\Program Files\Ahead

[19/05/2006|15:54] C:\Program Files\Altiris

[11/11/2008|04:17] C:\Program Files\Alwil Software

[30/04/2009|04:18] C:\Program Files\Audacity

[11/11/2008|05:28] C:\Program Files\Avira

[28/12/2007|19:20] C:\Program Files\AVS4YOU

[05/03/2009|03:05] C:\Program Files\Azureus

[18/02/2009|15:50] C:\Program Files\BitComet

[12/06/2006|10:59] C:\Program Files\BitTorrent

[06/05/2006|23:34] C:\Program Files\Call of Duty Single Player Demo

[31/07/2005|17:07] C:\Program Files\Camouflage

[23/05/2006|16:31] C:\Program Files\Canon

[28/07/2005|21:48] C:\Program Files\CDex_150

[16/11/2004|18:44] C:\Program Files\C-Media 3D Audio

[16/11/2004|17:04] C:\Program Files\ComPlus Applications

[08/11/2006|20:21] C:\Program Files\Datel

[26/11/2004|13:44] C:\Program Files\Disney Interactive

[07/06/2007|03:14] C:\Program Files\DivX

[01/04/2007|06:26] C:\Program Files\DkZ Studio

[01/04/2009|22:11] C:\Program Files\EASEUS

[18/06/2009|20:24] C:\Program Files\eMule

[19/03/2006|01:01] C:\Program Files\ETAJV DS

[23/07/2006|14:53] C:\Program Files\ffdshow

[01/04/2009|18:38] C:\Program Files\Fichiers communs

[05/01/2005|00:04] C:\Program Files\FileZilla

[04/11/2005|22:08] C:\Program Files\FLAC

[11/09/2006|21:19] C:\Program Files\GoldWave

[23/07/2006|14:53] C:\Program Files\Haali

[04/10/2008|00:50] C:\Program Files\IDM Computer Solutions

[28/07/2005|05:07] C:\Program Files\Illustrate

[03/10/2008|15:20] C:\Program Files\ImgBurn

[29/05/2008|18:39] C:\Program Files\InstallShield Installation Information

[04/12/2005|17:25] C:\Program Files\InterActual

[07/11/2006|11:53] C:\Program Files\Internet Download Manager

[30/04/2009|23:34] C:\Program Files\Internet Explorer

[27/03/2009|01:45] C:\Program Files\Java

[13/01/2006|22:46] C:\Program Files\Mario Forever

[13/01/2006|22:47] C:\Program Files\Mario Forever Toolbar

[16/09/2005|19:12] C:\Program Files\MatroskaProp

[29/04/2006|15:18] C:\Program Files\Maxtor

[03/06/2006|17:24] C:\Program Files\Media Player Classic

[25/11/2006|05:36] C:\Program Files\MediaCoder

[20/11/2004|01:57] C:\Program Files\Meridian Advance

[19/10/2008|15:27] C:\Program Files\Messenger

[16/11/2004|17:08] C:\Program Files\microsoft frontpage

[16/11/2004|17:46] C:\Program Files\Microsoft Office

[16/11/2004|17:47] C:\Program Files\Microsoft.NET

[14/06/2008|21:01] C:\Program Files\Mii Editor

[25/10/2007|03:55] C:\Program Files\Motherboard Monitor 5

[15/10/2008|15:14] C:\Program Files\Movie Maker

[16/09/2005|19:29] C:\Program Files\MRT Codecs Pack

[16/11/2004|17:04] C:\Program Files\MSN

[16/11/2004|17:04] C:\Program Files\MSN Gaming Zone

[14/09/2007|14:30] C:\Program Files\MSN Messenger

[08/11/2006|20:22] C:\Program Files\MSXML 4.0

[14/06/2009|16:06] C:\Program Files\MSXML 6.0

[08/10/2008|18:48] C:\Program Files\Navilog1

[24/06/2007|12:29] C:\Program Files\Navman

[15/10/2008|15:14] C:\Program Files\NetMeeting

[02/07/2007|05:02] C:\Program Files\NintendoVIP

[24/03/2007|06:35] C:\Program Files\Norton AntiVirus

[16/09/2005|19:09] C:\Program Files\On2 Technologies

[05/12/2005|03:07] C:\Program Files\ONES Trial (F)

[29/05/2008|18:53] C:\Program Files\Orange

[25/01/2007|05:12] C:\Program Files\Orb Networks

[15/10/2008|15:14] C:\Program Files\Outlook Express

[24/10/2007|14:42] C:\Program Files\PalickSoft

[26/11/2004|14:07] C:\Program Files\PAN vision

[04/07/2007|15:42] C:\Program Files\Pkd-X 2

[27/03/2009|01:52] C:\Program Files\PS3 Media Server

[25/10/2006|02:44] C:\Program Files\QuickSFV

[21/11/2004|14:00] C:\Program Files\QuickTime

[16/10/2006|05:22] C:\Program Files\Qvlyuvx

[08/11/2006|04:12] C:\Program Files\RADVideo

[03/06/2006|17:24] C:\Program Files\Real Alternative

[30/04/2007|19:50] C:\Program Files\Red Kawa

[10/11/2008|19:39] C:\Program Files\RegCleaner

[08/10/2008|20:13] C:\Program Files\RegFreeze

[08/11/2006|03:52] C:\Program Files\RM-X© Wmv To DivX

[14/06/2008|04:51] C:\Program Files\RomStation

[29/05/2008|18:39] C:\Program Files\SAGEM

[04/12/2005|17:10] C:\Program Files\SAMSUNG

[24/03/2007|06:59] C:\Program Files\SearchRelevant

[29/05/2008|18:38] C:\Program Files\Securitoo

[16/11/2004|17:06] C:\Program Files\Services en ligne

[24/11/2008|16:03] C:\Program Files\SHARP

[16/11/2004|18:43] C:\Program Files\SiSLan

[24/01/2005|22:01] C:\Program Files\SLD CODEC PACK 1.5.3

[17/09/2008|20:25] C:\Program Files\Smart Projects

[24/03/2007|06:41] C:\Program Files\Softwin

[23/12/2004|06:51] C:\Program Files\Sony

[02/06/2005|05:32] C:\Program Files\Soulseek

[27/10/2008|02:44] C:\Program Files\SpeedFan

[11/11/2008|21:08] C:\Program Files\Spybot - Search & Destroy

[24/03/2007|06:33] C:\Program Files\Symantec

[18/06/2009|15:04] C:\Program Files\The Cleaner

[05/01/2005|17:47] C:\Program Files\THQ

[24/03/2007|07:01] C:\Program Files\TopSearch

[21/06/2005|18:12] C:\Program Files\TrackManiaDemo

[10/11/2008|19:20] C:\Program Files\trend micro

[24/03/2007|07:01] C:\Program Files\TV Media

[09/06/2005|01:09] C:\Program Files\Ultra Video Splitter

[09/12/2004|12:20] C:\Program Files\Uninstall Information

[01/11/2008|21:57] C:\Program Files\vdicmyc

[16/10/2005|13:51] C:\Program Files\VideoLAN

[29/11/2005|18:50] C:\Program Files\Vivitar

[05/12/2005|03:03] C:\Program Files\VSO

[29/05/2008|18:50] C:\Program Files\Wanadoo

[05/09/2005|15:19] C:\Program Files\Wanadoo Messager

[24/03/2007|07:01] C:\Program Files\WebRebates4

[16/02/2009|18:31] C:\Program Files\Western Digital

[30/09/2005|01:24] C:\Program Files\Winamp

[07/12/2006|18:20] C:\Program Files\Windows Media Connect 2

[15/10/2008|15:14] C:\Program Files\Windows Media Player

[15/10/2008|15:14] C:\Program Files\Windows NT

[15/12/2005|03:38] C:\Program Files\Windows ServeAd

[15/12/2004|11:11] C:\Program Files\WindowsUpdate

[29/09/2008|01:33] C:\Program Files\WinRAR

[16/11/2004|17:08] C:\Program Files\xerox

[06/01/2008|18:27] C:\Program Files\Xilisoft

[16/09/2005|19:29] C:\Program Files\XviD

[01/01/2006|21:04] C:\Program Files\Yahoo!

[21/11/2004|04:46] C:\Program Files\YDKJWIN

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[01/04/2009|18:38] C:\Program Files\Fichiers communs\Acronis

[27/05/2005|15:11] C:\Program Files\Fichiers communs\Adobe

[14/06/2008|20:59] C:\Program Files\Fichiers communs\Adobe AIR

[04/12/2005|17:56] C:\Program Files\Fichiers communs\Ahead

[28/12/2007|19:20] C:\Program Files\Fichiers communs\AVSMedia

[16/11/2004|17:46] C:\Program Files\Fichiers communs\DESIGNER

[29/05/2008|18:49] C:\Program Files\Fichiers communs\France Telecom

[23/12/2004|06:45] C:\Program Files\Fichiers communs\InstallShield

[21/05/2006|18:24] C:\Program Files\Fichiers communs\Java

[28/12/2007|18:24] C:\Program Files\Fichiers communs\Microsoft Shared

[16/11/2004|17:05] C:\Program Files\Fichiers communs\MSSoap

[04/12/2005|17:59] C:\Program Files\Fichiers communs\Nero

[15/07/2006|20:35] C:\Program Files\Fichiers communs\NSV

[18/05/2008|22:42] C:\Program Files\Fichiers communs\Nullsoft

[16/11/2004|16:59] C:\Program Files\Fichiers communs\ODBC

[21/06/2005|18:16] C:\Program Files\Fichiers communs\Real

[16/11/2004|17:05] C:\Program Files\Fichiers communs\Services

[24/03/2007|06:41] C:\Program Files\Fichiers communs\Softwin

[23/12/2004|06:46] C:\Program Files\Fichiers communs\Sony Shared

[16/11/2004|16:59] C:\Program Files\Fichiers communs\SpeechEngines

[24/03/2007|06:35] C:\Program Files\Fichiers communs\Symantec Shared

[15/10/2008|15:14] C:\Program Files\Fichiers communs\System

[29/11/2005|18:50] C:\Program Files\Fichiers communs\ViviCam5DQ

--------------------\\ Process

( 17 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-19 13:43:14

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

disk error: C:\WINDOWS\System32\

please note that you need administrator rights to perform deep scan

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:712][D:36]-> C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp

[F:887][D:0]-> C:\DOCUME~1\UTILIS~1\Cookies

[F:4395][D:32]-> C:\DOCUME~1\UTILIS~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 19/06/2009|13:33 - Option : [1]

2 - "C:\Lop SD\LopR_2.txt" - 19/06/2009|13:45 - Option : [2]

--------------------\\ Fin du rapport a 13:45:38

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2307

Windows 5.1.2600 Service Pack 2

19/06/2009 15:08:02

mbam-log-2009-06-19 (15-08-02).txt

Type de recherche: Examen complet (C:\|F:\|)

Eléments examinés: 190549

Temps écoulé: 55 minute(s), 2 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 12

Valeur(s) du Registre infectée(s): 3

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 2

Fichier(s) infecté(s): 8

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1e5f0d38-214b-4085-ad2a-d2290e6a2d2c} (Adware.MediaAccess) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{018b7ec3-eeca-11d3-8e71-0000e82c6c0d} (Adware.ISTBar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7c559105-9ecf-42b8-b3f7-832e75edd959} (Adware.ISTBar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f919fbd3-a96b-4679-af26-f551439bb5fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{db893839-10f0-4af9-92fa-b23528f530af} (Dialer) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8f4e5661-f99e-4b3e-8d85-0ea71c0748e4} (Adware.NetOptimizer) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-0000-0000-0000-000020040000} (Trojan.Dialer) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\System\CurrentControlSet\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\System\CurrentControlSet\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\13672034 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\93682026 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

Dossier(s) infecté(s):

C:\Documents and Settings\All Users\Application Data\13672034 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\93682026 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

c:\documents and settings\all users\application data\13672034\13672034.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\13672034\13672034.glu (Rogue.Multiple.H) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\13672034\pc13672034cnf (Rogue.Multiple.H) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\13672034\pc13672034ins (Rogue.Multiple.H) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\93682026\93682026.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully.

c:\documents and settings\utilisateur\Bureau\programmes\sysreset253.exe (Spyware.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\utilisateur\application data\tvmknwrd.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\utilisateur\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.

pear · le 19 juin 2009

très bien.

Un nouveau rapport hijackthis, svp .

Gretel · le 19 juin 2009

Le voilà !

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:28:42, on 19/06/2009